CVE-2024-8925

Erroneous parsing of multipart form data

At a glance

Severity
LOW 3.1
EPSS
EPSS 0.94 % · percentile 61 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
php
NVD status
Modified

Description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Scores

VersionScoreVectorScored by
CVSS 3.1LOW 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:Nphp
CVSS 3.1LOW 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NNVD · security@php.net (Secondary)
CVSS 3.1MEDIUM 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NNVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
PHP Group · PHPaffected 8.1.* < 8.1.30 ; affected 8.2.* < 8.2.24 ; affected 8.3.* < 8.3.12

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD